BZ #108: DaCapo jython throws ArrayIndexOutOfBoundsException on powerpc.

Status fields:

creation_ts:2008-09-17 10:23
component:jit
version:default branch
rep_platform:powerpc
op_sys:All
bug_status:RESOLVED
resolution:FIXED
reporter:twisti@complang.tuwien.ac.at
Size small works but default and large are broken.

$ cacao -jar dacapo-2006-10-MR2.jar -s default jython
*sys-package-mgr*: processing new jar, '/localtmp/twisti/dacapo/dacapo-2006-10-MR2.jar'
*sys-package-mgr*: processing new jar, '/home/twisti/cacao/cacao/src/classes/vm.zip'
*sys-package-mgr*: processing new jar, '/nfs/nfstmp/twisti/powerpc-
linux/install/classpath/share/classpath/glibj.zip'
===== DaCapo jython starting =====
Traceback (innermost last):
  File "./scratch/jython/pybench/pybench.py", line 946, in ?
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/CommandLine.py", line 346, in
__init__
  File "./scratch/jython/pybench/pybench.py", line 912, in main
  File "./scratch/jython/pybench/pybench.py", line 537, in run
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py", line 325, in run
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/Constructs.py", line 12, in
test
java.lang.ArrayIndexOutOfBoundsException: 283965264
   at org.python.core.PyFrame.setlocal(Unknown Source)
   at
Constructs$py.test$2(/localtmp/twisti/dacapo/./scratch/jython/pybench/Constructs.py:12)
   at Constructs$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/Const
ructs.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at pybench$py.run$9(/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py:325)
   at
pybench$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.run$19(./scratch/jython/pybench/pybench.py:537)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.main$25(./scratch/jython/pybench/pybench.py:912)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at CommandLine$py.__init__$15(/localtmp/twisti/dacapo/./scratch/jython/pybench/Comman
dLine.py:346)
   at CommandLine$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/Comm
andLine.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyInstance.__init__(Unknown Source)
   at org.python.core.PyClass.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.f$0(./scratch/jython/pybench/pybench.py:946)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyCode.call(Unknown Source)
   at org.python.core.Py.runCode(Unknown Source)
   at org.python.core.__builtin__.execfile_flags(Unknown Source)
   at org.python.util.PythonInterpreter.execfile(Unknown Source)
   at org.python.util.jython.main(Unknown Source)
   at dacapo.jython.JythonHarness.iterate(JythonHarness.java:38)
   at dacapo.Benchmark.run(Benchmark.java:126)
   at dacapo.TestHarness.runBenchmark(TestHarness.java:302)
   at dacapo.TestHarness.main(TestHarness.java:242)
   at Harness.main(Harness.java:5)

java.lang.ArrayIndexOutOfBoundsException: java.lang.ArrayIndexOutOfBoundsException:
283965264

Comment #1 by twisti@complang.tuwien.ac.at on 2008-09-17 10:53:13

Ooops.  As I piped the output from above, some output is missing.  Here is the output
again:

$ cacao -jar dacapo-2006-10-MR2.jar -s default jython
*sys-package-mgr*: processing new jar, '/localtmp/twisti/dacapo/dacapo-2006-10-MR2.jar'
*sys-package-mgr*: processing new jar, '/localtmp/twisti/cacao/build-
gnuclasspath-m32/src/classes/vm.zip'
*sys-package-mgr*: processing new jar, '/nfs/nfstmp/twisti/powerpc-
linux/install/classpath/share/classpath/glibj.zip'
===== DaCapo jython starting =====
-------------------------------------------------------------------------------
PYBENCH 2.0
-------------------------------------------------------------------------------
* using Python 2.2a1
* Python version doesn't support garbage collection
* system check interval set to maximum: 2147483647
* using timer: time.time

Calibrating tests. Please wait...

Running 1 round(s) of the suite at warp factor 20:

Traceback (innermost last):
  File "./scratch/jython/pybench/pybench.py", line 946, in ?
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/CommandLine.py", line 346, in
__init__
  File "./scratch/jython/pybench/pybench.py", line 912, in main
  File "./scratch/jython/pybench/pybench.py", line 537, in run
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py", line 325, in run
  File "/localtmp/twisti/dacapo/./scratch/jython/pybench/Constructs.py", line 12, in
test
java.lang.ArrayIndexOutOfBoundsException: 283591808
   at org.python.core.PyFrame.setlocal(Unknown Source)
   at
Constructs$py.test$2(/localtmp/twisti/dacapo/./scratch/jython/pybench/Constructs.py:12)
   at Constructs$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/Const
ructs.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at pybench$py.run$9(/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py:325)
   at
pybench$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.run$19(./scratch/jython/pybench/pybench.py:537)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.main$25(./scratch/jython/pybench/pybench.py:912)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyMethod.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at CommandLine$py.__init__$15(/localtmp/twisti/dacapo/./scratch/jython/pybench/Comman
dLine.py:346)
   at CommandLine$py.call_function(/localtmp/twisti/dacapo/./scratch/jython/pybench/Comm
andLine.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyFunction.__call__(Unknown Source)
   at org.python.core.PyInstance.__init__(Unknown Source)
   at org.python.core.PyClass.__call__(Unknown Source)
   at org.python.core.PyObject.__call__(Unknown Source)
   at org.python.pycode._pyx1.f$0(./scratch/jython/pybench/pybench.py:946)
   at org.python.pycode._pyx1.call_function(./scratch/jython/pybench/pybench.py)
   at org.python.core.PyTableCode.call(Unknown Source)
   at org.python.core.PyCode.call(Unknown Source)
   at org.python.core.Py.runCode(Unknown Source)
   at org.python.core.__builtin__.execfile_flags(Unknown Source)
   at org.python.util.PythonInterpreter.execfile(Unknown Source)
   at org.python.util.jython.main(Unknown Source)
   at dacapo.jython.JythonHarness.iterate(JythonHarness.java:38)
   at dacapo.Benchmark.run(Benchmark.java:126)
   at dacapo.TestHarness.runBenchmark(TestHarness.java:302)
   at dacapo.TestHarness.main(TestHarness.java:242)
   at Harness.main(Harness.java:5)

java.lang.ArrayIndexOutOfBoundsException: java.lang.ArrayIndexOutOfBoundsException:
283591808

Comment #2 by twisti@complang.tuwien.ac.at on 2008-09-17 10:54:04

The exception throwing basic block is:

======== L001 ======== (flags: 1, bitflags: 0, next: 2, type: STD, icount: 7, preds: 1 [
0 ]):
succs: 1 [ 3 ]
IN:  [] javalocals: [La0(r30) Li1(r29) La2(r28)]
   0:   4:  ALOAD           L0 => La0(r30)
   0:   5:  GETFIELD        La0(r30) <field> org.python.core.PyFrame.f_fastlocals
[Lorg/python/core/PyObject; PUBLIC, offset: 36 => Ta9!(r31)
   0:   6:  ILOAD           L1 => Li1(r29)
   0:   7:  ALOAD           L2 => La2(r28)
   0:   8:  AASTORE         Ta9!(r31) Li1(r29) La2(r28)
   0:   9:  GOTO            --> L003
   0:  10:  NOP
OUT: []

0x30ba07c4:   83fe0024    lwz     r31,36(r30)
0x30ba07c8:   821f0008    lwz     r16,8(r31)
0x30ba07cc:   7cbd8008    twlge   r29,r16
0x30ba07d0:   820dffe8    lwz     r16,-24(r13)
0x30ba07d4:   7e0903a6    mtctr   r16
0x30ba07d8:   7fe3fb78    mr      r3,r31
0x30ba07dc:   7f84e378    mr      r4,r28
0x30ba07e0:   4e800421    bctrl
0x30ba07e4:   7c631b79    mr.     r3,r3
0x30ba07e8:   40820008    bne-    0x0000000030ba07f0
0x30ba07ec:   80000003    lwz     r0,3(0)
0x30ba07f0:   57ac103a    rlwinm  r12,r29,2,0,29
0x30ba07f4:   398c000c    addi    r12,r12,12
0x30ba07f8:   7f9f612e    stwx    r28,r31,r12
0x30ba07fc:   48000040    b       0x0000000030ba083c

Comment #3 by twisti@complang.tuwien.ac.at on 2008-09-17 10:56:07

The trap instruction is:

0x30ba07cc:   7cbd8008    twlge   r29,r16

r16 seems to be OK:

r16            0x5      5

But r29 looks like an object address:

r29            0x10e39708       283350792

Because r30 (this pointer) is:

r30            0x110cbf00       286048000

Comment #4 by twisti@complang.tuwien.ac.at on 2008-09-17 11:07:23

It fails with the same exception on the cacao-1.0.x branch.  So it's not related to
recent changes.

Comment #5 by twisti@complang.tuwien.ac.at on 2008-09-17 11:17:44

I'm not sure if I can trust the backtrace in GDB:

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 805478432 (LWP 30824)]
0x30ba07cc in ?? ()
(gdb) bt
#0  0x30ba07cc in ?? ()
#1  0x30ccc404 in ?? ()
#2  0x30ccc404 in ?? ()
#3  0x30c42808 in ?? ()
#4  0x30b7635c in ?? ()
#5  0x30b7e8bc in ?? ()

but the calling instructions seem to be:

======== L001 ======== (flags: 1, bitflags: 0, next: 2, type: STD, icount: 15, preds: 1
[ 361 ]):
succs: 2 [ 10 2 ]
IN:  [] javalocals: [- La0(r28) La1(r27) La2(r26) La3(r25) -]
  12:  77:  ALOAD           L0 => La0(r28)
  12:  78:  ICONST          3 (0x00000003) => Ai52( r4)
  12:  79:  ALOAD           L2 => La2(r26)
  12:  80:  INVOKEVIRTUAL   La0(r28) Ai52( r4) La2(r26) <method>
org.python.core.PyFrame.setlocal(ILorg/python/core/PyObject;)V PUBLIC (mono) (impl)

<snip>

  12:
0x30ccc3e8:   38800003    li      r4,3
0x30ccc3ec:   7f45d378    mr      r5,r26
0x30ccc3f0:   7f83e378    mr      r3,r28
0x30ccc3f4:   81830000    lwz     r12,0(r3)
0x30ccc3f8:   81ac036c    lwz     r13,876(r12)
0x30ccc3fc:   7da903a6    mtctr   r13
0x30ccc400:   4e800421    bctrl
0x30ccc404:   7d6802a6    mflr    r11
0x30ccc408:   39abfcbc    addi    r13,r11,-836

Setting r4 to 3 looks OK so I don't know why (and where) it gets destroyed.

Comment #6 by twisti@complang.tuwien.ac.at on 2008-09-17 16:20:32

The trace log is HUGE.  After about 400 million calls we have the faulting one:

LOG: [0xf7fda000]  399853665 -54-
                called: org.python.core.PyFrame.setlocal(ILorg/python/core/PyObject;)V
PUBLIC(0x10da8
e40 (Class = "org.python.core.PyFrame"), 8 (0x00000008), 0x11586e90 (Class =
"org.python.core.PyInteger"))

Comment #7 by twisti@complang.tuwien.ac.at on 2008-09-17 16:22:51

The caller is:

LOG: [0xf7fda000]  399853532 -53-
        called:
Constructs$py.test$2(Lorg/python/core/PyFrame;)Lorg/python/core/PyObject; PUBLIC(0x11
5defb0 (Class = "Constructs$py"), 0x10da8e40 (Class = "org.python.core.PyFrame"))

Comment #8 by twisti@complang.tuwien.ac.at on 2008-09-17 16:27:37

Found the bug.  It's a backward branch:

======== L361 ======== (flags: 1, bitflags: 0, next: 362, type: STD, icount: 9, preds: 4
[ 0 357 359 360 ]):
succs: 2 [ 1 362 ]
IN:  [] javalocals: [- La0(r28) La1(r27) La2(r26) La3(r25) -]
  12:4371:  ALOAD           L0 => La0(r28)
  12:4372:  ICONST          12 (0x0000000c) => Ai48( r4)
  12:4373:  INVOKEVIRTUAL   La0(r28) Ai48( r4) <method>
org.python.core.PyFrame.setline(I)V PUBLIC (mono) (impl)
  12:4374:  ALOAD           L1 => La1(r27)
  12:4375:  INVOKEVIRTUAL   La1(r27) <method>
org.python.core.PyObject.__iternext__()Lorg/python/core/PyObject; PUBLIC (impl) =>
La2(r26)
  12:4376:  ASTORE          La2(r26) => L2  (javaindex 3)
  12:4377:  ALOAD           L2 => La2(r26)
  12:4378:  IFNONNULL       La2(r26) --> L001
  12:4379:  NOP
OUT: []

  12:
0x30cd5bb8:   3880000c    li      r4,12
0x30cd5bbc:   7f83e378    mr      r3,r28
0x30cd5bc0:   81830000    lwz     r12,0(r3)
0x30cd5bc4:   81ac0354    lwz     r13,852(r12)
0x30cd5bc8:   7da903a6    mtctr   r13
0x30cd5bcc:   4e800421    bctrl
0x30cd5bd0:   7d6802a6    mflr    r11
0x30cd5bd4:   3dabffff    addis   r13,r11,-1
0x30cd5bd8:   39ad64f0    addi    r13,r13,25840
0x30cd5bdc:   7f63db78    mr      r3,r27
0x30cd5be0:   81830000    lwz     r12,0(r3)
0x30cd5be4:   81ac010c    lwz     r13,268(r12)
0x30cd5be8:   7da903a6    mtctr   r13
0x30cd5bec:   4e800421    bctrl
0x30cd5bf0:   7d6802a6    mflr    r11
0x30cd5bf4:   3dabffff    addis   r13,r11,-1
0x30cd5bf8:   39ad64d0    addi    r13,r13,25808
0x30cd5bfc:   7c7a1b78    mr      r26,r3
0x30cd5c00:   7f5ad379    mr.     r26,r26
0x30cd5c04:   41820008    beq-    0x0000000030cd5c0c
0x30cd5c08:   4bff67e4    b       0x0000000030ccc3ec

The branch address is off by one:

0x30cd5c08:   4bff67e4    b       0x0000000030ccc3ec

Should be:

0x30ccc3e8

Comment #9 by twisti@complang.tuwien.ac.at on 2008-09-17 16:54:12

Fixed with: http://mips.complang.tuwien.ac.at/hg/cacao/rev/3d4bd3fd4886